https://aznot.com/index.php?action=history&feed=atom&title=ESX%2FVMware_Syslog_Collector
ESX/VMware Syslog Collector - Revision history
2026-05-07T03:51:05Z
Revision history for this page on the wiki
MediaWiki 1.41.0
https://aznot.com/index.php?title=ESX/VMware_Syslog_Collector&diff=2439&oldid=prev
Kenneth at 21:49, 27 August 2015
2015-08-27T21:49:09Z
<p></p>
<p><b>New page</b></p><div>== VMware Syslog Collector ==<br />
<br />
== Installation Defaults ==<br />
<br />
Install vSphere Syslog Collector to:<br />
C:\Program Files (x86)\VMware\VMware Syslog Collector\<br />
<br />
vSphere Syslog Collector Configuration:<br />
* Repository directory:<br />
C:\Documents and Settings\All Users\Application Data\VMware\VMware Syslog Collector\Data\<br />
# I like to change to:<br />
C:\syslog\<br />
* Size of log file before rotation: 2MB<br />
* Log rotations to keep: 8 (I like to change to 30)<br />
<br />
vSphere Syslog Collector Server Port:<br />
514 (TCP Protocol and UDP Protocol)<br />
<br />
vSphere Syslog Collector Server SSL Port:<br />
1514 (Secure connection (SSL))<br />
<br />
== Configure ESXi 5.0 Server ==<br />
<br />
Display the existing 5 configuration options on the host using the command:<br />
esxcli system syslog config get<br />
<br />
Default settings:<br />
<pre><br />
Default Rotation Size: 1024<br />
Default Rotations: 8<br />
Log Output: /scratch/log<br />
Log To Unique Subdirectory: false<br />
Remote Host: <none><br />
</pre><br />
<br />
Set new host configuration, specifying options to change, using a command similar to:<br />
<br />
# reset to defaults<br />
for i in default-rotate default-size logdir loghost ; do esxcli system syslog config set --reset $i ; done<br />
esxcli system syslog config set --default-size=1024 --default-rotate=8 --logdir=/scratch/log --logdir-unique=false<br />
<br />
Remote log hosting:<br />
# Get configuration<br />
esxcli system syslog config get<br />
<br />
# to configure remote syslog using TCP on port 514:<br />
#esxcli system syslog config set --loghost='tcp://10.10.47.100:514'<br />
#esxcli system syslog config set --loghost=10.10.47.100<br />
esxcli system syslog config set --loghost=esxlogger<br />
<br />
# may need to adjust the firewall too<br />
esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true<br />
esxcli network firewall refresh<br />
<br />
# After making configuration changes, load the new configuration using the command:<br />
esxcli system syslog reload<br />
<br />
Example of configured setup:<br />
<pre><br />
# esxcli system syslog config get<br />
Local Log Output: <none><br />
Local Logging Default Rotation Size: 1024<br />
Local Logging Default Rotations: 8<br />
Log To Unique Subdirectory: false<br />
Remote Host: esxlogger.oeey.com<br />
</pre><br />
<br />
<br />
These can also be set from the GUI:<br />
* vSphere Client GUI > Configuration > Software > Advanced Settings > Syslog.global.logHost<br />
* vSphere Client GUI > Configuration > Software > Security Profile > Firewall > syslog<br />
<br />
Send message:<br />
# normally logged to /var/log/vmkernel.log and /var/log/syslog.log and /var/log/*.log too!<br />
esxcli system syslog mark --message="this is a message"<br />
<br />
You can also test sending a message with:<br />
nc 10.10.47.100 514<br />
telnet 10.10.47.100 514<br />
... message ...<br />
<br />
VCSA check service:<br />
/etc/init.d/syslog-collector status<br />
<br />
# config file:<br />
/etc/syslog-ng/syslog-collector.conf<br />
References:<br />
* [http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vcli.migration.doc_50%2Fcos_upgrade_technote.1.6.html vSphere Documentation Center - Logging in vSphere 5.0]<br />
* VMware KB: Configuring syslog on ESXi 5.0 - http://kb.vmware.com/kb/2003322<br />
<br />
== keywords ==<br />
<br />
[[Category:VMware]]</div>
Kenneth